The vulnerability exists in parseusbs versions prior to 1.9. The tool accepts a volume path argument via the -v flag, which is directly inserted into an os.popen() shell command that runs ls. Because the input is not sanitized, an attacker can insert shell metacharacters to execute arbitrary commands during the enumeration process. This allows the attacker to run any shell command with the privileges of the user running parseusbs, effectively achieving remote code execution or elevated privilege exploitation if the tool is run as root.

Affected systems are installations of parseusbs by the vendor khyrenz. Any instance of the tool with a major version lower than 1.9 is vulnerable. This includes the open-source distribution on GitHub and any downstream deployments that have not applied the patch in commit 99f05996494e7e41ea0c7e13145ba20eb793e46b or merged pull request 10.

The CVSS base score of 8.4 indicates high severity. EPSS is under 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation at present. The attack vector relies on supplying a crafted -v argument, which implies the attacker needs the ability to invoke parseusbs, typically a local or user‑level adversary. If the tool is run with elevated privileges, arbitrary command execution could lead to full system compromise. Therefore organizations should treat this as a high‑risk issue while the exploit probability remains modest.